hxxps://drive[.]google[.]com/file/d/1HlkHu4lPyp_A0ytJbFKgJMJ37PtUhsMK/view

Analysis

max time kernel
523s
max time network
525s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
15-11-2024 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1HlkHu4lPyp_A0ytJbFKgJMJ37PtUhsMK/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
4	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
3052	msedge.exe
3052	msedge.exe
3916	msedge.exe
3916	msedge.exe
880	identity_helper.exe
880	identity_helper.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1484	3052	msedge.exe	77
PID 3052 wrote to memory of 1484	3052	msedge.exe	77
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4264	3052	msedge.exe	78
PID 3052 wrote to memory of 4548	3052	msedge.exe	79
PID 3052 wrote to memory of 4548	3052	msedge.exe	79
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80
PID 3052 wrote to memory of 4868	3052	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1HlkHu4lPyp_A0ytJbFKgJMJ37PtUhsMK/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdcc063cb8,0x7ffdcc063cc8,0x7ffdcc063cd8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,17383343466371909943,8057623256823915378,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aad1d98ca9748cc4c31aa3b5abfe0fed

SHA1
32e8d4d9447b13bc00ec3eb15a88c55c29489495

SHA256
2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

SHA512
150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb557349d7af9d6754aed39b4ace5bee

SHA1
04de2ac30defbb36508a41872ddb475effe2d793

SHA256
cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

SHA512
f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
2f8ef0d85f139b4b63c5475f2fd9fb71

SHA1
0ef3d4999a28bdc206f5051f5a041c52be59227e

SHA256
1c61e6614dde14baecc61e1d3310508ecbd1bd400202de703afa164e3d5418ab

SHA512
1ad0223afcd6883f35b1da5db8f7459d3e851a45a8e9035fdd8af9350b1a870542572087d6c87080678eece5e2d4fbc6aaf74f9a17d9270d8bf0b55cc78f04d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
eaa78aefbae9c122e3e1ac558b18eda8

SHA1
f2f6234456fba8e18dc016fb521a557c45744826

SHA256
e88d7c0d5eeb1f171db3bba56bc442581344a95473b88eccc65dcfb83b853c1b

SHA512
f3b832111a4a508ea60a69828167296da0c07d449867728cfe05fbee1d7acbec765c5e87c69e886ca06ecbe69003268b2338210a882229c897218c5fbf0b0245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
69e3baec7eab632429e7de2c7780d864

SHA1
e2145f4da02adea6c2dc016ca1ad2303a012020a

SHA256
b5de801c53143fdc94e808f737f2d9be11e03d4361a7b3e62f7ee9d07fb4ed62

SHA512
bcf5ad8c9f59e9bcb47b3f64b38a52802dffddad8740f6378ab587e5233bf2a62183be8cb5f04dc64585d1fe259dea5a0e1d757c37b6a4eb4eb6d2b2d9fcbe92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f021b8ee0ca126a513f4e9c4f5b97df7

SHA1
114d49186086fd543e28424b1209cada32250bda

SHA256
483b2733f01b922e78cba40e3ffefa9e603526bb531550e001ef2e0eb6a7cc86

SHA512
0b92f342a4a216e9a0354e450ef070b8f1d4efaae2ce764ccb3b8e571581a2d5c3505fdae6787a71960959d409b3226290efd0faff874e8ecea2106cd3216b4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
640e9b4e504bba20fe4423be96dadc2f

SHA1
0da0c26a9e0b38dd3eddc89bd7740fec60318585

SHA256
e86a9968ae36d3417e47875e90dd162e69ae26438080508b544b224d08729724

SHA512
6d31acf59ac63671b1680ec1be8758d064da69ff875eedcea11cb8e68c3b655f416f823b747140f3ac42cc38866b28d73a02727cf0309771a84697252e99d1ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b2ad0b3daf0808e3c103923b2cdbbf9e

SHA1
b86c964eccd890e251ce9f70cf061a4ba3a6e1e5

SHA256
72de9c9761d5429322bb6c9d775b349bc8f559cb0ecbaaab6f994d3e3bd1fcbd

SHA512
7d2cc2e39cb46ee5db0955f88fe119e010db3b38acddc723b3f34b7fe5269d0576c7b101fc364fa7e6df0ca2cefd4485c8f94726f74c67668d09ac28c66b220b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
20a0633481a07b3bc7fee9c030d91222

SHA1
1c5f81d26b62f8e3662e8e437be333b806911900

SHA256
8c7bb7663e8f7110bdfd88ade9226e29005135ada305fed54cd482c25c77f546

SHA512
03105d4c6d13aa4c7d9b860137109d38632df38143312f1fd424a13fa0eeffb13fed3854f1b0cdd25bf1036961f46a0225387bfa747b25c1ecb2abbd0648424d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d52022ba392680ed1492077f04f5230b

SHA1
5d90b2a7376b9ce57873c9bc6c51f3b4821688b4

SHA256
9748f498fa33a47701b969d6d97c6c7448cdd3704afee0396f7444aab32d7f5e

SHA512
95eb4f8fda727b25899c909ac148c84ec80b35bbeb37173488532634542935ed85a34db6859c7978c17c97529cce0a4e61a234fb45bdce6127438d0e4a17dbeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a8207b5e342393fe262bbd47a10fd21f

SHA1
45fab448323495adcf65b44a68e86e0b3c2a1359

SHA256
b3387b5cdac950ce214265dfbaff16bc83150745c9e7eaa5a0e968e69ddf85c3

SHA512
5a167dbd6ea0263d01b4697b45b5f912ef6f58ca542739236a534e8a21fe32583737e9942b42be815d9f619209f452d134f1b803c8d4ae09263cb757c0d41c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b901f6528dbc8077a8060e008a7a6381

SHA1
c3a07a9aab1c06d88a69fa60417a1048fcf4b05e

SHA256
660e29ad829beb77966994dce4d3c58d73e5758c11b531c189e9258ee9016f2b

SHA512
fb74f7da20786f7d8e2f2b316e75b93b1362023509bcc30225f6afa6ff3d1af616b741ba1a1afc139e632ca15f7fcbc403e83326e10533e2086b8b2c879f9e9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c549664d6e58e44a2d903320c32c2e05

SHA1
6880bc52bf3a9d51a128ecd7464fa294a92d0e47

SHA256
7ed849975a55cb084598011053b0e1cc6e7cdf4d36604e966fea3b7aee20247d

SHA512
89a33851545b455ac1f20385abff2a8645fe120e7a16e834b78be6c8d7a326ad08ff6e7389963405a00436da83bf2e8fb35b16338287a09cd94828bc3cf32b57

Download Submit